1 files changed, 0 insertions, 56 deletions

diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
deleted file mode 100644
index e46ce436e1..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-Upstream-Status: Backport
-
-Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com>
-
-From 477c74395acd0123340457ba6f15ab345d42016e Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sat, 2 May 2015 19:23:04 +0300
-Subject: [PATCH 3/5] EAP-pwd peer: Fix Total-Length parsing for fragment
- reassembly
-
-The remaining number of bytes in the message could be smaller than the
-Total-Length field size, so the length needs to be explicitly checked
-prior to reading the field and decrementing the len variable. This could
-have resulted in the remaining length becoming negative and interpreted
-as a huge positive integer.
-
-In addition, check that there is no already started fragment in progress
-before allocating a new buffer for reassembling fragments. This avoid a
-potential memory leak when processing invalid message.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/eap_peer/eap_pwd.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
-index a629437..1d2079b 100644
---- a/src/eap_peer/eap_pwd.c
-+++ b/src/eap_peer/eap_pwd.c
-@@ -866,11 +866,23 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
-         * if it's the first fragment there'll be a length field
-         */
-        if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
-+               if (len < 2) {
-+                       wpa_printf(MSG_DEBUG,
-+                                  "EAP-pwd: Frame too short to contain Total-Length field");
-+                       ret->ignore = TRUE;
-+                       return NULL;
-+               }
-                tot_len = WPA_GET_BE16(pos);
-                wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
-                           "total length = %d", tot_len);
-                if (tot_len > 15000)
-                        return NULL;
-+               if (data->inbuf) {
-+                       wpa_printf(MSG_DEBUG,
-+                                  "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
-+                       ret->ignore = TRUE;
-+                       return NULL;
-+               }
-                data->inbuf = wpabuf_alloc(tot_len);
-                if (data->inbuf == NULL) {
-                        wpa_printf(MSG_INFO, "Out of memory to buffer "
--- 
-1.9.1
-